--- title: "Burp Project Parser: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-burpsuite-project-parser/ description: "Extract and search captured Burp traffic while distinguishing empty results from parser startup failures." --- # Burp Project Parser: review, setup & limitations · Undominated.ai > Extract and search captured Burp traffic while distinguishing empty results from parser startup failures. [← Explore all skills](/skills/) SECURITY / trailofbits # Burp Project Parser Extract and search captured Burp traffic while distinguishing empty results from parser startup failures. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/tree/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/burpsuite-project-parser/skills/burpsuite-project-parser) SOURCE REVIEW Reviewed 2026-10-14 Evidence 4 linked sources Publisher trailofbits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Revision 8e54050ae63c [Read what was—and wasn’t—checked ↓](#review) “Searches and explores Burp Suite project files (.burp) from the command line. Use when searching response headers or bodies with regex patterns, extracting security audit” [trailofbits · upstream description ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/burpsuite-project-parser/skills/burpsuite-project-parser/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Parsing is delegated to a local Burp Suite Professional process. The skill text says it does not parse .burp files itself. - Response bodies longer than 1000 characters are forbidden in the agent context, and full proxy or site-map dumps are marked to avoid. - The wrapper checks required files, classifies empty and non-object output separately, preserves Java failures and bounds non-JSON stderr. - Inspect captured request headers before selecting bounded response bodies ### A good fit for - Querying a saved Burp project on disk when Burp Professional and the parser extension are already installed. - Keeping captured bodies out of the chat and looking at headers first. - Inspect captured request headers before selecting bounded response bodies - Triage stored Burp audit findings with their severity and confidence kept separate ### Weigh up before choosing - The shell script launches the local burpsuite_pro.jar headless. It does not ship Burp and it does not open a new scan against a host. - A pipeline that ends in jq or head hides the script's exit code, which the skill says is how a missing extension looks like an empty result. - This review did not execute the resource. - Requires Burp Suite Professional and the separately installed third-party parser extension; the skill licence does not license either dependency. - Exit 3 is ambiguous between no matches and an unavailable extension; use a known populated control query. - The wrapper recognizes object-looking lines by a leading brace rather than validating JSON syntax; validate downstream. The definition also reverses the displayed order of wc -cl output: it prints lines then bytes. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/burpsuite-project-parser/skills/burpsuite-project-parser/SKILL.md - plugins/burpsuite-project-parser/skills/burpsuite-project-parser/scripts/burp-search.sh - LICENSE - README.md ### Our findings - The skill does not parse the project file. burp-search.sh runs the local Burp jar with java.awt.headless and a --project-file argument. - It requires Burp Suite Professional and the project-file parser extension. Without the jar path it exits with an error. - Bodies over 1000 characters must not be pulled into context, and the file says not to dump proxy history or the site map whole. - The wrapper checks required files, classifies empty and non-object output separately, preserves Java failures and bounds non-JSON stderr. - Source inspection confirms stdout filtering is lexical, not a JSON parser; SIGPIPE from intentional downstream truncation is handled. ### Not established by this review - The resource was not executed and its tools were not called. - burp-search.sh was not executed and Burp was not started. - No skill execution, authenticated service operation, or outcome benchmark was performed. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) DOCUMENTED COMMAND npx skills add trailofbits/skills/plugins/burpsuite-project-parser/skills/burpsuite-project-parser Copy command ↗ Run in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above. Optional: install the reviewed revision Keeps the original source and installer version where recorded, while leaving your AI tools and installation scope for you to choose. npx skills add https://github.com/trailofbits/skills/tree/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/burpsuite-project-parser/skills/burpsuite-project-parser Copy reviewed-revision command ↗ - Install the pinned skill directory interactively, retaining its bundled references and scripts. - Set BURP_JAVA and BURP_JAR when defaults do not match the installation. - Run a small control query on the same project, preserve stderr and pipeline exit status, then narrow selectors and output size. ### Before you start - Burp Suite Professional - burpsuite-project-file-parser extension - Java, bash and bounded JSON-processing tools ### Compatibility Agents supporting directory-based SKILL.md instructions ### Local instructions; runtime access depends on the workflow - Launch local Burp and read .burp projects containing potentially sensitive captured headers, tokens and bodies; write only selected exports. ### Cost model Instructions are free; agent usage and separately licensed tools can incur charges. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Pinned skill definition ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/burpsuite-project-parser/skills/burpsuite-project-parser/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/burpsuite-project-parser/skills/burpsuite-project-parser/SKILL.md Supports: summary, whySelected, bestFor, limitations, install, access, review - [Publisher repository and installation guidance ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/README.md Supports: install - [CC-BY-SA-4.0 licence ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/LICENSE Supports: license - [plugins/burpsuite-project-parser/skills/burpsuite-project-parser/scripts/burp-search.sh ↗](https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/burpsuite-project-parser/skills/burpsuite-project-parser/scripts/burp-search.sh) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/8e54050ae63c2f62224c35b1616efe71865b4777/plugins/burpsuite-project-parser/skills/burpsuite-project-parser/scripts/burp-search.sh Supports: review, limitations, access, install KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### C and C++ Security Review ↗ Coordinate scoped native C/C++ security review and assemble findings with an explicit coverage ledger.](/skills/trailofbits-c-review/)[### DWARF Debug Information ↗ Inspect DWARF symbols, types, line tables and address mappings using tool-specific commands.](/skills/trailofbits-dwarf-expert/)[### Security Audit Preparation ↗ Prepare a frozen, buildable codebase and evidence package for an external security review.](/skills/trailofbits-audit-prep-assistant/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)